1228 matches found
CVE-2026-12243-NLTK-PoC
CVE-2026-12243 — NLTK Path Traversal Lab A small, reproducible Docker lab that contrasts the percent-encoded path traversal behavior in NLTK 3.9.4 with the corrected behavior in NLTK 3.10.0. The vulnerable version validates the resource name before URL decoding. The fixed payload...
GHSA-89P3-FCCH-88PH NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
Summary The public CCG lexicon parser nltk.ccg.lexicon.fromstring parses caller-influenced lexicon text with two pure-Python loops whose cost is quadratic in the input width. A service that parses an untrusted CCG lexicon string can be driven into tens of seconds of single-threaded CPU by a...
NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
Summary The public CCG lexicon parser nltk.ccg.lexicon.fromstring parses caller-influenced lexicon text with two pure-Python loops whose cost is quadratic in the input width. A service that parses an untrusted CCG lexicon string can be driven into tens of seconds of single-threaded CPU by a...
EUVD-2026-125222
NLTK: Quadratic-time CPU denial of service in CCG lexicon parser fromstring on wide bracket bodies and operator chains...
NLTK: Quadratic-time CPU denial of service in Tree.chomsky_normal_form right-factor binarization via list.pop(0)
Summary Tree.chomskynormalform binarizes a parse tree and defaults to right factoring. For a node with N children the right-factor branch repeatedly removes the first element of a working list with list.pop0, which shifts all remaining elements each time, so binarizing one wide node costs ON^2. A...
EUVD-2026-125223
NLTK: Quadratic-time CPU denial of service in Tree.chomskynormalform right-factor binarization via list.pop0...
GHSA-R53H-RW34-8H97 NLTK: Quadratic-time CPU denial of service in Tree.chomsky_normal_form right-factor binarization via list.pop(0)
Summary Tree.chomskynormalform binarizes a parse tree and defaults to right factoring. For a node with N children the right-factor branch repeatedly removes the first element of a working list with list.pop0, which shifts all remaining elements each time, so binarizing one wide node costs ON^2. A...
GHSA-V8F3-6PHW-6MH9 NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan
Summary ConllCorpusReader.srlinstances builds semantic-role-labeling instances from a CoNLL corpus block. For a sentence block with P predicates and P span columns, the instance builder rescans every span column and every span within it once per predicate while searching for each predicate's head...
NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan
Summary ConllCorpusReader.srlinstances builds semantic-role-labeling instances from a CoNLL corpus block. For a sentence block with P predicates and P span columns, the instance builder rescans every span column and every span within it once per predicate while searching for each predicate's head...
EUVD-2026-125224
NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan...
PT-2026-147350
Summary Tree.chomsky normal form binarizes a parse tree and defaults to right factoring. For a node with N children the right-factor branch repeatedly removes the first element of a working list with list.pop0, which shifts all remaining elements each time, so binarizing one wide node costs ON^2...
PT-2026-147337
Summary The public CCG lexicon parser nltk.ccg.lexicon.fromstring parses caller-influenced lexicon text with two pure-Python loops whose cost is quadratic in the input width. A service that parses an untrusted CCG lexicon string can be driven into tens of seconds of single-threaded CPU by a...
PT-2026-147353
Summary ConllCorpusReader.srl instances builds semantic-role-labeling instances from a CoNLL corpus block. For a sentence block with P predicates and P span columns, the instance builder rescans every span column and every span within it once per predicate while searching for each predicate's hea...
GHSA-FG9W-WFP5-J933 NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read
Summary BllipParser in nltk/parse/bllip.py hands caller-supplied filesystem paths to the native bllipparser C extension without routing them through NLTK's pathsec validation. The constructor parameters parsermodel, rerankerfeatures, and rerankerweights, and the alternative fromunifiedmodeldir...
NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read
Summary BllipParser in nltk/parse/bllip.py hands caller-supplied filesystem paths to the native bllipparser C extension without routing them through NLTK's pathsec validation. The constructor parameters parsermodel, rerankerfeatures, and rerankerweights, and the alternative fromunifiedmodeldir...
CVE-2026-128134
The NLTK (Natural Language Toolkit) Python suite versions prior to 3.10.4 are vulnerable to local code execution via an untrusted search path. The nltk.parse.dependencygraph.dot2img function resolves the Graphviz dot executable through the PATH but fails to route the resulting absolute executable...
CVE-2026-0847
CVE-2026-0847 — NLTK Multiple CorpusReader Classes: Arbitrary File Read via Path Traversal -orange?style=for-the-badge Overview Field| Details ---|--- CVE ID| CVE-2026-0847 Package| nltk Natural Language Toolkit Registry| PyPI Affected Versions| = 3.9.2 Vulnerability Type| CWE-22: Path Traversal...
CVE-2026-0848-Scanner---Herramienta-de-Detecci-n
🔍 CVE-2026-0848 Scanner Detection tool for the CVE-2026-0848 vulnerability in NLTK arbitrary code execution in StanfordSegmenter. ⚡ Installation git clone https://github.com/tu-usuario/CVE-2026-0848-Scanner.git cd CVE-2026-0848-Scanner pip install -r requirements.txt...
CVE-2026-0848-PoC-Improper-Input-Validation
CVE-2026-0848 - NLTK StanfordSegmenter RCE PoC ⚠️ WARNING This code executes arbitrary commands on your system. Use ONLY in virtual machines or isolated containers. Description Functional PoC for CVE-2026-0848. Demonstrates how a malicious JAR file can execute arbitrary code when loaded by NLTK...
Duplicate Advisory: Quadratic-time CPU denial of service in NLTK CCG lexicon parser (fromstring) on wide bracket bodies and operator chains
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-89p3-fcch-88ph. This link is maintained to preserve external references. Original Description NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote...